search for: kvmi_event_msr

From: Mihai Don?u <mdontu at bitdefender.com> This command is used to enable/disable introspection for a specific MSR. The KVMI_EVENT_MSR event is send when the tracked MSR is going to be changed. The introspection tool can respond by allowing the guest to continue with normal execution or by discarding the change. This is meant to prevent malicious changes to MSRs such as MSR_IA32_SYSENTER_EIP. Signed-off-by: Mihai Don?u <mdont...

From: Mihai Don?u <mdontu at bitdefender.com> This command is used to enable/disable introspection for a specific MSR. The KVMI_EVENT_MSR event is sent when the tracked MSR is going to be changed. The introspection tool can respond by allowing the guest to continue with normal execution or by discarding the change. This is meant to prevent malicious changes to MSRs such as MSR_IA32_SYSENTER_EIP. Signed-off-by: Mihai Don?u <mdont...

From: Mihai Don?u <mdontu at bitdefender.com> The KVMI_CONTROL_MSR is used to enable/disable introspection for a specific MSR. The KVMI_EVENT_MSR is send when the tracked MSR is going to be changed. The introspection tool can respond by allowing the guest to continue with normal execution or by discarding the change. This is meant to prevent malicious changes to MSR-s such as MSR_IA32_SYSENTER_EIP. Signed-off-by: Mihai Don?u <mdontu at...

..., 177 insertions(+), 9 deletions(-) diff --git a/Documentation/virt/kvm/kvmi.rst b/Documentation/virt/kvm/kvmi.rst index ffa183745722..3515fea1eb75 100644 --- a/Documentation/virt/kvm/kvmi.rst +++ b/Documentation/virt/kvm/kvmi.rst @@ -547,6 +547,7 @@ the following events:: KVMI_EVENT_HYPERCALL KVMI_EVENT_MSR KVMI_EVENT_PF + KVMI_EVENT_SINGLESTEP KVMI_EVENT_TRAP KVMI_EVENT_XSETBV @@ -1352,3 +1353,30 @@ The *CONTINUE* action will continue the page fault handling via emulation. The *RETRY* action is used by the introspection tool to retry the execution of the current instruction, usually because...

...ed(struct kvm_vcpu *vcpu) { } #endif /* CONFIG_KVM_INTROSPECTION */ diff --git a/include/uapi/linux/kvmi.h b/include/uapi/linux/kvmi.h index bc515237612a..040049abd450 100644 --- a/include/uapi/linux/kvmi.h +++ b/include/uapi/linux/kvmi.h @@ -63,6 +63,7 @@ enum { KVMI_EVENT_DESCRIPTOR = 7, KVMI_EVENT_MSR = 8, KVMI_EVENT_PF = 9, + KVMI_EVENT_SINGLESTEP = 10, KVMI_NUM_EVENTS }; @@ -236,4 +237,9 @@ struct kvmi_event_pf { __u32 padding3; }; +struct kvmi_event_singlestep { + __u8 failed; + __u8 padding[7]; +}; + #endif /* _UAPI__LINUX_KVMI_H */ diff --git a/tools/testing/self...

From: Mihai Don?u <mdontu at bitdefender.com> This is needed for the KVMI_EVENT_MSR event. Signed-off-by: Mihai Don?u <mdontu at bitdefender.com> Co-developed-by: Nicu?or C??u <ncitu at bitdefender.com> Signed-off-by: Nicu?or C??u <ncitu at bitdefender.com> Signed-off-by: Adalbert Laz?r <alazar at bitdefender.com> --- arch/x86/include/asm/kvm_host.h | 2 +...

From: Mihai Don?u <mdontu at bitdefender.com> This is needed for the KVMI_EVENT_MSR event, which is used notify the introspection tool about any change made to a MSR of interest. Signed-off-by: Mihai Don?u <mdontu at bitdefender.com> Co-developed-by: Nicu?or C??u <ncitu at bitdefender.com> Signed-off-by: Nicu?or C??u <ncitu at bitdefender.com> Signed-off-by: Ada...

...b/virt/kvm/kvmi_int.h @@ -23,6 +23,8 @@ #define kvmi_err(ikvm, fmt, ...) \ kvm_info("%pU ERROR: " fmt, &ikvm->uuid, ## __VA_ARGS__) +#define KVMI_MSG_SIZE_ALLOC (sizeof(struct kvmi_msg_hdr) + KVMI_MSG_SIZE) + #define KVMI_KNOWN_VCPU_EVENTS ( \ BIT(KVMI_EVENT_CR) | \ BIT(KVMI_EVENT_MSR) | \ @@ -91,4 +93,9 @@ void kvmi_sock_shutdown(struct kvmi *ikvm); void kvmi_sock_put(struct kvmi *ikvm); bool kvmi_msg_process(struct kvmi *ikvm); +/* kvmi.c */ +void *kvmi_msg_alloc(void); +void *kvmi_msg_alloc_check(size_t size); +void kvmi_msg_free(void *addr); + #endif diff --git a/virt/k...

...N = 22, + KVMI_GET_MTRR_TYPE = 23, + KVMI_CONTROL_SPP = 24, + KVMI_GET_PAGE_WRITE_BITMAP = 25, + KVMI_SET_PAGE_WRITE_BITMAP = 26, + KVMI_CONTROL_CMD_RESPONSE = 27, + + KVMI_NEXT_AVAILABLE_COMMAND, + +}; + +enum { + KVMI_EVENT_UNHOOK = 0, + KVMI_EVENT_CR = 1, + KVMI_EVENT_MSR = 2, + KVMI_EVENT_XSETBV = 3, + KVMI_EVENT_BREAKPOINT = 4, + KVMI_EVENT_HYPERCALL = 5, + KVMI_EVENT_PF = 6, + KVMI_EVENT_TRAP = 7, + KVMI_EVENT_DESCRIPTOR = 8, + KVMI_EVENT_CREATE_VCPU = 9, + KVMI_EVENT_PAUSE_VCPU = 10, + KVMI_EVENT_SINGLESTEP = 11, + + KVMI_NUM_EVEN...

...MI_VCPU_CONTROL_CR and KVMI_EVENT_CR KVM: introspection: add KVMI_VCPU_INJECT_EXCEPTION + KVMI_EVENT_TRAP KVM: introspection: add KVMI_EVENT_XSETBV KVM: introspection: add KVMI_VCPU_GET_XSAVE KVM: introspection: add KVMI_VCPU_GET_MTRR_TYPE KVM: introspection: add KVMI_VCPU_CONTROL_MSR and KVMI_EVENT_MSR KVM: introspection: add KVMI_VM_SET_PAGE_ACCESS KVM: introspection: add KVMI_EVENT_PF KVM: introspection: emulate a guest page table walk on SPT violations due to A/D bit updates KVM: x86: call the page tracking code on emulation failure Mircea C?rjaliu (2): KVM: x86: disable gpa_ava...

...M and vCPU commands smushed together? > + > + KVMI_NEXT_AVAILABLE_COMMAND, Why not KVMI_NR_COMMANDS or KVM_NUM_COMMANDS? At least be consistent between COMMANDS and EVENTS below. > + > +}; > + > +enum { > + KVMI_EVENT_UNHOOK = 0, > + KVMI_EVENT_CR = 1, > + KVMI_EVENT_MSR = 2, > + KVMI_EVENT_XSETBV = 3, > + KVMI_EVENT_BREAKPOINT = 4, > + KVMI_EVENT_HYPERCALL = 5, > + KVMI_EVENT_PF = 6, > + KVMI_EVENT_TRAP = 7, > + KVMI_EVENT_DESCRIPTOR = 8, > + KVMI_EVENT_CREATE_VCPU = 9, > + KVMI_EVENT_PAUSE_VCPU = 10, > + K...

...MI_VCPU_CONTROL_CR and KVMI_EVENT_CR KVM: introspection: add KVMI_VCPU_INJECT_EXCEPTION + KVMI_EVENT_TRAP KVM: introspection: add KVMI_EVENT_XSETBV KVM: introspection: add KVMI_VCPU_GET_XSAVE KVM: introspection: add KVMI_VCPU_GET_MTRR_TYPE KVM: introspection: add KVMI_VCPU_CONTROL_MSR and KVMI_EVENT_MSR KVM: introspection: add KVMI_VM_SET_PAGE_ACCESS KVM: introspection: add KVMI_EVENT_PF KVM: introspection: emulate a guest page table walk on SPT violations due to A/D bit updates KVM: x86: call the page tracking code on emulation failure Mircea C?rjaliu (2): KVM: x86: disable gpa_ava...

...EAD_PHYSICAL and KVMI_WRITE_PHYSICAL kvm: introspection: add KVMI_GET_REGISTERS kvm: introspection: add KVMI_SET_REGISTERS kvm: introspection: add KVMI_INJECT_EXCEPTION + KVMI_EVENT_TRAP kvm: introspection: add KVMI_CONTROL_CR and KVMI_EVENT_CR kvm: introspection: add KVMI_CONTROL_MSR and KVMI_EVENT_MSR kvm: introspection: add KVMI_GET_XSAVE kvm: introspection: add KVMI_GET_MTRR_TYPE kvm: introspection: add KVMI_EVENT_XSETBV kvm: introspection: add KVMI_EVENT_BREAKPOINT kvm: introspection: add KVMI_EVENT_HYPERCALL kvm: introspection: use single stepping on unimplemented instructions...

...EAD_PHYSICAL and KVMI_WRITE_PHYSICAL kvm: introspection: add KVMI_GET_REGISTERS kvm: introspection: add KVMI_SET_REGISTERS kvm: introspection: add KVMI_INJECT_EXCEPTION + KVMI_EVENT_TRAP kvm: introspection: add KVMI_CONTROL_CR and KVMI_EVENT_CR kvm: introspection: add KVMI_CONTROL_MSR and KVMI_EVENT_MSR kvm: introspection: add KVMI_GET_XSAVE kvm: introspection: add KVMI_GET_MTRR_TYPE kvm: introspection: add KVMI_EVENT_XSETBV kvm: introspection: add KVMI_EVENT_BREAKPOINT kvm: introspection: add KVMI_EVENT_HYPERCALL kvm: introspection: use single stepping on unimplemented instructions...